3 ms·

Using anything other than PCR 7 is going to make it very fragile, yes - I have no idea why that doc is recommending using PCR 4 as well.

• lostmsu 3y ago
  To defend against an attacker with physical access to an offline machine you need to verify anything that the attacker can overwrite without the encryption key. Aren't bootloader and kernel on the writable unencrypted partition?
  • mjg59 3y ago
    If you have secure boot enabled, how does the attacker replace the kernel or bootloader?
    • lostmsu 3y ago
      Pull the drive out, insert it into his machine, replace, then insert it back.
      • mjg59 3y ago
        And now the signature doesn't match, so the system doesn't boot
        • lostmsu 3y ago
          Which signature?
          • mjg59 3y ago
            The signature that's validated by secure boot. If you don't have secure boot turned on then there's no point in verifying PCR 7, because all PCR 7 contains is the secure boot data.